Class ConfluentTrustManager

java.lang.Object

javax.net.ssl.X509ExtendedTrustManager

io.confluent.kafka.server.plugins.ssl.ConfluentTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

Direct Known Subclasses:

NetworkLinkTrustManager

public class ConfluentTrustManager
extends X509ExtendedTrustManager

Custom trust manager for validating client and server certificates in Confluent Cloud.

This trust manager supports multiple certificate validation strategies for inbound connections where the broker acts as a TLS server accepting mTLS client authentication:

Certificate Validation Priority:

1. SPIRE Validation: If SPIRE is enabled, validates client certificates using the SPIFFE trust manager for service-to-service authentication.
2. Server Certificate as Client Certificate: If useServerCertForClientAuth is enabled, accepts server certificates (e.g., Let's Encrypt) for client authentication by using checkServerTrusted() instead of checkClientTrusted(). This bypasses EKU (Extended Key Usage) validation that would reject server-only certs.
3. Default Validation: Validates that the certificate belongs to Confluent Cloud by checking the Subject Alternative Name (SAN), then delegates to the default trust manager for chain validation.

Configuration:

• ConfluentConfigs.SPIRE_SERVERSIDE_VALIDATION_ENABLED - Enable SPIRE validation on server-side
• ConfluentConfigs.MTLS_USE_SERVER_CERT_FOR_CLIENT_AUTH_SERVERSIDE_ENABLED - Accept server certificates for client authentication on server-side (supports dynamic configuration update)

Field Summary

Fields

Modifier and Type	Field	Description
static final String	METRICS_GROUP
static final String	MIN_REMOTE_CLIENT_CERT_EXPIRY_MS
static final String	SERVER_CERT_VALIDATION_FAILURE_RATE
static final String	SERVER_CERT_VALIDATION_FAILURE_TOTAL
static final String	SERVER_CERT_VALIDATION_SUCCESS_RATE
static final String	SERVER_CERT_VALIDATION_SUCCESS_TOTAL
static final String	SPIRE_VALIDATION_FAILURE_RATE
static final String	SPIRE_VALIDATION_FAILURE_TOTAL
static final String	SPIRE_VALIDATION_SUCCESS_RATE
static final String	SPIRE_VALIDATION_SUCCESS_TOTAL

Constructor Summary

Constructors

Constructor	Description
ConfluentTrustManager(Map<String,?> configs, X509ExtendedTrustManager defaultTrustManager)

Method Summary

Modifier and Type	Method	Description
void	checkClientTrusted(X509Certificate[] x509Certificates, String authType)
void	checkClientTrusted(X509Certificate[] x509Certificates, String authType, Socket socket)
void	checkClientTrusted(X509Certificate[] x509Certificates, String authType, SSLEngine sslEngine)
void	checkServerTrusted(X509Certificate[] x509Certificates, String authType)
void	checkServerTrusted(X509Certificate[] x509Certificates, String authType, Socket socket)
void	checkServerTrusted(X509Certificate[] x509Certificates, String authType, SSLEngine sslEngine)
X509Certificate[]	getAcceptedIssuers()	Returns the accepted CA issuers for client authentication.
boolean	verifyClientCerts(X509Certificate[] x509Certificates)
boolean	verifyServerCerts(X509Certificate[] x509Certificates)

Methods inherited from class Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

MIN_REMOTE_CLIENT_CERT_EXPIRY_MS

public static final String MIN_REMOTE_CLIENT_CERT_EXPIRY_MS

See Also:

• Constant Field Values

METRICS_GROUP

public static final String METRICS_GROUP

See Also:

• Constant Field Values

SPIRE_VALIDATION_SUCCESS_TOTAL

public static final String SPIRE_VALIDATION_SUCCESS_TOTAL

See Also:

• Constant Field Values

SPIRE_VALIDATION_SUCCESS_RATE

public static final String SPIRE_VALIDATION_SUCCESS_RATE

See Also:

• Constant Field Values

SPIRE_VALIDATION_FAILURE_TOTAL

public static final String SPIRE_VALIDATION_FAILURE_TOTAL

See Also:

• Constant Field Values

SPIRE_VALIDATION_FAILURE_RATE

public static final String SPIRE_VALIDATION_FAILURE_RATE

See Also:

• Constant Field Values

SERVER_CERT_VALIDATION_SUCCESS_TOTAL

public static final String SERVER_CERT_VALIDATION_SUCCESS_TOTAL

See Also:

• Constant Field Values

SERVER_CERT_VALIDATION_SUCCESS_RATE

public static final String SERVER_CERT_VALIDATION_SUCCESS_RATE

See Also:

• Constant Field Values

SERVER_CERT_VALIDATION_FAILURE_TOTAL

public static final String SERVER_CERT_VALIDATION_FAILURE_TOTAL

See Also:

• Constant Field Values

SERVER_CERT_VALIDATION_FAILURE_RATE

public static final String SERVER_CERT_VALIDATION_FAILURE_RATE

See Also:

• Constant Field Values

Constructor Details

ConfluentTrustManager

public ConfluentTrustManager(Map<String,?> configs,
 X509ExtendedTrustManager defaultTrustManager)

Method Details

checkClientTrusted

public void checkClientTrusted(X509Certificate[] x509Certificates,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] x509Certificates,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] x509Certificates,
 String authType,
 SSLEngine sslEngine)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] x509Certificates,
 String authType,
 SSLEngine sslEngine)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] x509Certificates,
 String authType)
                        throws CertificateException

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] x509Certificates,
 String authType)
                        throws CertificateException

Throws:

CertificateException

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()

Returns the accepted CA issuers for client authentication.

This list is sent to clients in the TLS CertificateRequest message (certificate_authorities extension). Clients use this to decide which certificate to present.

When SPIRE is enabled, this returns both:

• Default (Let's Encrypt) CAs
• SPIRE trust bundle CAs

verifyClientCerts

public boolean verifyClientCerts(X509Certificate[] x509Certificates)
                          throws CertificateException

Throws:

CertificateException

verifyServerCerts

public boolean verifyServerCerts(X509Certificate[] x509Certificates)
                          throws CertificateException

Throws:

CertificateException